CIP-014-3 R1 Transmission risk assessment requirements

What CIP-014-3 R1 asks Transmission Owners to identify first

Requirement R1 of CIP-014-3 asks each Transmission Owner to run a risk assessment, made up of transmission analyses, that identifies which of its applicable Transmission stations and substations could cause instability, uncontrolled separation or Cascading within an Interconnection if they were rendered inoperable or damaged. The assessment covers existing facilities and those planned within the next 24 months. It is the starting point for everything that follows in the standard, because the stations it names are the ones that later need third-party verification, threat evaluation and a physical security plan. An entity that cannot show how it reached its list will struggle to defend every later step.

R1 has two parts that an assessor will check separately. Part 1.1 sets the repetition cycle: the first assessment is followed by subsequent assessments at least once every 30 calendar months if the previous one identified any qualifying facility, or at least once every 60 calendar months if it identified none. Part 1.2 requires the entity to identify the primary control center that operationally controls each identified station or substation, which links the physical analysis to the operating structure. R1 carries a High Violation Risk Factor, so the Compliance Enforcement Authority will expect a documented method, clear assumptions and defensible results rather than a list produced ad hoc.

The analysis is hard to repeat consistently because the answer depends on power system conditions that change. Load, generation dispatch, planned outages and topology shift over time, and each new or planned facility within the 24-month horizon can alter which stations matter. Engineers who rebuild the study years later may use different models, contingency sets or criteria than the original team. Entities should confirm the study tools, study criteria, data sources and versioning they will use, record who approved each assumption, and keep the results traceable to the period they describe. The NERC CIP-014-3 standard defines the requirement language, and the entity should confirm its interpretation with its Regional Entity before the first assessment is finalized.

Which stations, substations and teams fall inside the R1 analysis

The R1 analysis starts with a scope question: which existing and planned Transmission stations and substations the Transmission Owner must evaluate. The cards below cover the facilities, the planning horizon, the system model and studies behind the results, the people who sign off, and the primary control center identification that completes the same deliverable.

Applicable existing stations and substations

Start by listing every Transmission station and substation the Transmission Owner operates that is applicable under CIP-014-3 R1. The list is the baseline for every later decision, so each facility needs a documented source, such as an asset register or a one-line diagram, and a record of who checked it. Confirm the list against the current topology, because a stale inventory can silently drop a facility from the analysis.

Planned facilities within 24 months

R1 also reaches facilities that are planned within the next 24 months, so the scope is not limited to what is energized today. Track approved projects, interconnection studies and retirement decisions that change the list. Record the planning date used for each facility so an assessor can see why it was in or out of the analysis at the time.

System model and study choices

The transmission analysis depends on the Transmission Owner's system model and the studies run against it, including the contingencies and operating conditions tested. Document the model version, the data sources, and the assumptions that determine whether a loss could cause instability, uncontrolled separation or Cascading. Two teams using different models can reach different conclusions, so the model choice itself needs review.

Planners and coordinators in the analysis

Many Transmission Owners rely on a registered planner, a Planning Coordinator or an internal planning group to perform or support the transmission analysis. Confirm in writing who performs each study, who owns the model, and how their work feeds the R1 conclusions. Ask for the staffing and credentials of anyone outside the organization before engaging them, and confirm their roles against the current NERC registration records.

Sign-off and documented decisions

Someone accountable must approve the final list of identified facilities, and that approval should be dated and traceable to the analysis that supports it. Record exclusions, the reason for each one, and any open questions about model data. Auditors look for evidence that the decision was made by the right person at the right time, not only that a list exists.

Primary control center under Part 1.2

Part 1.2 requires the Transmission Owner to identify the primary control center that operationally controls each identified station or substation, and this sits in the same deliverable as the risk assessment. Map each facility to its controlling center in the same record, and keep that mapping current when operating responsibilities change. The control center mapping feeds later physical security work in R4 and R5.

How an assessor tests the R1 risk assessment

The timing test starts from the previous risk assessment and the result it recorded. If that assessment identified any qualifying facility, the next one must be completed within 30 calendar months. If it identified none, the interval is 60 calendar months. The assessor checks the arithmetic against dated records, so the entity needs proof of when each cycle was completed and approved, along with the determination that set the interval. The CIP-014-3 standard governs these intervals, and the assessor will work from it directly.

Prior result drives the interval: The assessor confirms that the interval applied matches the outcome recorded in the earlier assessment.
Completion date, not start date: The file should show when the analysis was finished and signed off, and the cycle is measured from that record.
Missed cycles: A common finding is a 60-month interval applied after an earlier assessment had identified facilities, which pushes the next due date past the deadline.
Late recognition of changes: When a later study changes the result, the file should show when the entity recognized the change and which cycle it moved to.

Confirm that every cycle since the first assessment has a dated, approved record and that the interval used matches the result recorded for the prior cycle.

How to build an R1 assessment that holds up on audit

The sequence below turns CIP-014-3 R1 into a dated, reviewable record: the facility list, the analysis behind it, the screening decisions, the primary control centers and the next due date. Each step leaves an output that an auditor can trace to the next.

Confirm the applicable Transmission facilities
The Transmission Owner, usually through its compliance and planning staff, lists every existing Transmission station and substation it owns or operates, plus any facility planned within the next 24 months. The list is the scope of the assessment, so it needs a named owner and a date. Done means a signed facility inventory that states the source of each entry, such as the asset register or planning model, and the planning horizon used.
Commission or run the transmission analysis
Planning engineers perform the transmission analysis themselves or hire a qualified consultant to do it. Confirm the study method, the system models, the contingencies tested and the assumptions with the vendor or consultant before work begins, and ask for the model version and data cut-off date in writing. Done means a study report that shows which facilities were tested and how each result was reached.
Screen results for instability, separation or Cascading
Reviewers compare each study result against the R1 criterion: would loss of the station or substation, rendered inoperable or damaged, cause instability, uncontrolled separation or Cascading within an Interconnection. The screening decision for every facility, whether identified or not, must be recorded with its reasoning. Done means a screening table that covers the full facility list, with each result traceable to a specific study case.
Identify the primary control center for each facility
For each identified station or substation, staff confirm which control center operationally controls it, which satisfies Part 1.2. Operations and the control center owner should verify this against current operating procedures, not only the planning records, because control responsibilities can change. Done means a list pairing each identified facility with its primary control center, confirmed by operations staff.
Record the next assessment due date
Set the next subsequent assessment date from the result. Part 1.1 requires reassessment at least once every 30 calendar months if any facility was identified, or at least once every 60 calendar months if none was. Ask your compliance lead to confirm the trigger date and enter the due date in the compliance calendar with a named owner. Done means a dated calendar entry linked to the assessment record.
Obtain documented sign-off
The accountable executive or designated approver reviews the facility inventory, study report, screening table, control center list and due date, then signs. Retain the signed package with the study models and the version of the assessment that was approved. Done means a complete, dated and approved assessment package that an auditor can request and read without asking the team to reconstruct it.

Evidence that satisfies R1 and how to keep it current

An auditor testing CIP-014-3 R1 looks for a dated, repeatable record that shows how the Transmission Owner found its stations and substations and who approved the result. The cards below cover each artifact, then the habits that keep the record current between the 30 and 60 month cycles.

Dated risk assessment report

The core artifact is a written report that states the date the transmission analysis was performed, the scope of existing and planned stations and substations within the 24 month planning window, and the facilities identified. Auditors compare its date against the next-due calculation, so the report must show when the analysis was completed, not when it was drafted. Confirm that each identified facility is named in the report and that no facility is referred to only by a nickname.

Study inputs and model versions

The transmission analysis depends on power flow and contingency models, load forecasts and topology snapshots. An auditor will ask which model version, data set and study tool produced each result, and whether the same inputs can be reproduced. Keep a manifest for each study that lists input files, their versions and the tool release used, so the analysis can be rerun if its conclusions are challenged.

Criteria and methodology record

The report should state the criteria used to decide that a station or substation, if rendered inoperable or damaged, could cause instability, uncontrolled separation or Cascading within an Interconnection. Record the thresholds, contingencies tested and engineering judgment applied, with the reasoning behind each. A methodology that changes between cycles without a documented reason invites questions about consistency.

Identified facilities and primary control centers

Part 1.2 requires each identified station or substation to be linked to the primary control center that operationally controls it. Maintain a single list that shows each facility, its identifier, its primary control center and the study result that placed it on the list. Reconcile this list against the operating diagrams and control center records, because a facility moved between control centers is a common source of findings.

Approval records and sign-off

Retain evidence of who reviewed and approved the risk assessment, with dates and the role of each approver. The approval should be traceable to the version of the report that was finalized, not to an earlier draft. Confirm that the approver had authority under the entity's governance and that the approval is retained in a location that survives staff turnover.

Next-due calculation and version control

Record the next assessment due date, calculated from the completion date of the current assessment and the result, either 30 or 60 calendar months. Store every study document in a version-controlled repository, such as a wiki with page history, so each change records what was edited, when and by whom, and earlier versions can be compared and restored. Set a recurring reminder tied to the due date and check that the calendar and the repository show the same date.

What meeting CIP-014-3 R1 costs in money and effort

This table breaks down the cost components of the R1 transmission risk assessment, marks which ones are one-time and which recur every assessment cycle, and lists the drivers that move each cost up or down. No fees or durations are supplied for this requirement, so use the table to structure your own estimate and to ask consistent questions when you request quotes.

Cost component	Who is paid or who spends effort	One-time or recurring	What drives it, and what to ask for in a quote
Transmission analysis engineering	Internal planning engineers or an external consultant performing the transmission analyses	Recurring, at each initial and subsequent assessment	Number of existing stations and substations and those planned within 24 months. Ask for the study scope, the facilities covered and the assumptions used.
Study software and licenses	Software vendor or licensing reseller, paid by the Transmission Owner	Usually recurring, with possible one-time setup	Whether models are already licensed for planning studies. Confirm license terms, seat counts and whether a consultant's tools are billed separately.
Network model and data preparation	Internal staff or consultant assembling current system models and topology data	Recurring, with one-time model build	Model currency and the quality of existing data. Ask whether model updates between cycles are included in the quote.
Internal review and sign-off	Senior planning or compliance staff who review results and approve the identified list	Recurring, at each assessment	Number of reviewers and the governance path to approval. Confirm who signs off and how long the approval step is expected to take.
Identification of primary control centers (Part 1.2)	Operations or planning staff who confirm which control center operationally controls each identified facility	Recurring, with one-time mapping	Number of identified facilities and changes in operating responsibilities. Keep the mapping current so updates do not require a full reassessment.
Evidence upkeep	Compliance staff who retain analyses, assumptions, approvals and dated records for audit	Recurring, continuous	Retention practices and how easily results can be traced to a specific assessment. Confirm the retention period in your own compliance program.
Independent verification planned under R2	Registered planner, coordinator or experienced transmission analyst, engaged by the Transmission Owner	Recurring, per assessment cycle	Scope of the R1 results to be verified and the 90-day completion window. Ask for the verifier's qualifications and whether engagement can start before the assessment ends.
Effort to act on verification recommendations	Internal planning staff, possibly with consultants, responding to R2 recommendations	Variable, arises only when recommendations are made	Number and complexity of recommendations and the 60-day window to act. Ask how the quote handles reassessment if facilities change.

Who owns the R1 analysis, who prepares it and who checks it

The Transmission Owner holds the R1 obligation. It must perform the initial and subsequent transmission analyses, decide which existing and planned stations and substations could cause instability, uncontrolled separation or Cascading if lost, and identify the primary control center that operationally controls each one. Those decisions are the entity's to make and to defend. An outside firm can run modeling or document the analysis, but the entity signs off on the results and carries the consequences if they are wrong.

Accountable decisions: The entity approves the list of identified facilities and the basis for each inclusion or exclusion.
Assessment cadence: The entity tracks the 30 or 60 calendar month cycle and the 24 month planning horizon for planned facilities.
Control center mapping: The entity records which primary control center operationally controls each identified station or substation.
Records retained: The entity keeps the study inputs, assumptions, models and approvals that an auditor will ask to see.
Input to later requirements: The R1 list feeds R2 verification, R4 evaluations, R5 plans and R6 review.

Before you start, confirm who inside your organization signs the R1 results and where the study files will be kept for audit.

Where R1 assessments usually fall short

R1 assessments tend to fail on dates, on the link between the analysis and the real grid, and on proof that a reviewer can follow. The four cards below cover the gaps that appear most often, with a practical check for each. Each check is something the Transmission Owner can confirm before an assessor asks.

Missed 30 or 60 month dates

R1 Part 1.1 sets the next due date from the result of the previous assessment: at least once every 30 calendar months if it identified any qualifying facility, or every 60 calendar months if it identified none. Teams often calendar the date from the report approval day rather than the completion date of the analysis, or they forget that a finding changes the cycle. Check that the compliance calendar records which branch applies, the trigger date, and the owner of the next assessment.

Control center mappings that drift

Part 1.2 requires each identified station or substation to be linked to the primary control center that operationally controls it. Operating responsibilities change through reorganizations, control center consolidations and transfers of operating authority, so a mapping that was correct at the last assessment can be wrong at the next one. Compare the mapping against current operating agreements and the operations team's records, and document who confirmed each link and when.

Planned facilities outside the window

R1 covers existing stations and substations and those planned within the 24 month window that follows the assessment. Planned projects often sit in engineering queues, load studies or interconnection requests and never reach the list used for the analysis. Ask planning staff to produce a dated list of planned facilities at the start of each assessment, and record the cut-off date used to decide which projects fall inside the window.

Evidence that cannot be traced

An assessor will ask how each conclusion was reached: which network model, which contingencies, which version of the data, and who approved the result. Reports that cite a model without its version or that omit the study inputs leave the assessor unable to repeat the work. Keep a versioned record of inputs, study files, approval sign-offs and the rationale for each station included or excluded, and keep a wiki or document history that shows what changed between cycles.

Questions buyers ask about CIP-014-3 R1

How much effort does CIP-014-3 R1 take to complete?

The effort depends mainly on how many stations and substations the Transmission Owner must analyze, how many planned facilities fall within the 24-month planning horizon, and how current the transmission models are. R1 is a transmission analysis, so the largest cost component is engineering time from planners or analysts who run contingency studies against the system model. The initial assessment is a one-time effort, and each subsequent assessment recurs at the interval set in Part 1.1. Ask any provider for a written scope that lists the number of facilities, the study tools and model versions, the deliverables (the assessment report and the Part 1.2 control center list), and who performs and signs off the analysis. Because R1 carries a High Violation Risk Factor, the cost of a weak analysis is often higher than the cost of a rigorous one once verification and audit follow-up are included.

How long does one R1 assessment cycle take to prepare?

The standard sets the deadline through the cycle itself, not through a fixed preparation period. Part 1.1 requires a subsequent assessment at least once every 30 calendar months if the previous assessment identified any qualifying facility, or at least once every 60 calendar months if it identified none. Preparation time therefore depends on the cycle length, the size of the transmission model, and how quickly planned facilities within the 24-month horizon are confirmed. Plan backward from the due date: confirm the system model and planned projects, run the analysis, document the results and the control center mapping, then pass the output into R2 verification, which must be completed within 90 calendar days. Ask each provider to show its preparation schedule against the due date in writing.

What does a Transmission Owner need to provide for R1?

The Transmission Owner must supply the technical inputs that the analysis depends on. In practice, that means:

A current transmission model and one-line diagrams covering each existing station and substation in scope.
Planned transmission projects expected within the 24-month horizon that R1 covers.
Operating records that show which primary control center operationally controls each identified station or substation, as Part 1.2 requires.
Documented study tools, assumptions and contingency criteria used in the transmission analysis.
Named staff accountable for the assessment, its review and its approval.

Missing or outdated inputs are the most common reason an assessment takes longer than planned, so confirm data ownership and access before the cycle starts. An implementation partner can help organize these records, but the Transmission Owner remains responsible for the data itself.

Can a Transmission Owner run CIP-014-3 R1 in-house?

A Transmission Owner can perform R1 with its own planning engineers, provided they have the analytical capability and the model access to run the transmission analysis. The standard does not require an outside analyst for R1 itself. The independence requirement sits in R2, which requires verification by an unaffiliated registered planner or coordinator, or an experienced transmission analyst, within 90 calendar days. An in-house R1 therefore needs a separate, independent verification step, and that verification is usually where outside help is needed. Keep the analysis, the records and the approvals traceable so an auditor can follow the work from model to result. An implementation partner can help with evidence organization, record retention and document control, but the transmission analysis itself belongs to the Transmission Owner's planners or an outside analyst it engages.

How are the 30 and 60 month R1 cycles chosen?

The cycle is set by the outcome of the previous assessment, not by the entity's preference. If the previous assessment identified any station or substation whose loss could cause instability, uncontrolled separation or Cascading, the next assessment is due at least once every 30 calendar months. If it identified none, the interval is at least once every 60 calendar months. Record the count of identified facilities and the basis for it in each assessment report, because that record sets the next due date and an auditor will check it. The wording says at least, so an earlier assessment is permitted, but the 30 or 60 month clock starts from the completion of the prior assessment. Build a compliance calendar from the approved report date, not from the date the analysis began.

How does R1 connect to R2 and R4 through R6?

R1 produces the list that drives every later requirement. Its identified stations, substations and primary control centers become the scope for the other CIP-014-3 requirements:

R2 requires unaffiliated third-party verification of the R1 assessment within 90 calendar days.
R4 requires a physical threat and vulnerability evaluation at each identified station, substation and primary control center.
R5 requires a physical security plan developed within 120 days of verification.
R6 requires an unaffiliated third-party review of the R4 evaluation and R5 plan within 90 days.

An error in R1, such as a missing facility or a wrong control center, carries forward into every later step. Keep one controlled list of facilities and control centers, and tie each R4 to R6 record back to the R1 report version it relies on.

What evidence will an auditor expect from an R1 assessment?

An auditor will expect a complete, dated record that connects the transmission analysis to its conclusions. The core evidence set includes the approved assessment report, the transmission models and study inputs used, the documented analysis method, the list of identified stations and substations, the Part 1.2 mapping of each to its primary control center, and the approval record. The Regional Entity schedules monitoring of registered entities on a risk-based basis, and entities registered as Balancing Authorities, Reliability Coordinators or Transmission Operators receive a Compliance Audit at least once every three years. Read the CIP-014-3 standard for the exact wording of each part, and confirm with your Regional Entity which evidence it requests before it asks for it.

How R1 feeds the verification and physical security steps

The R1 output is the starting list for everything that follows in CIP-014-3. The stations and substations identified under Requirement R1, and the primary control center recorded under Part 1.2 for each one, define the facilities that the unaffiliated third-party verification under R2 must check, the physical threat and vulnerability evaluations under R4 must cover, and the physical security plan under R5 must protect. A facility left off the R1 list is not verified, not evaluated and not planned for, so its omission can carry through the whole program without anyone noticing. A facility on the list that should not be there creates unnecessary evaluation, review and security work. Both kinds of error spread into every later step, which is why the R1 analysis deserves the same documentation discipline as the later deliverables.

Before the R1 results leave the transmission planning team, confirm three things. First, that the transmission analysis record shows the study basis, the contingencies tested and the criteria used to judge whether a loss could cause instability, uncontrolled separation or Cascading within an Interconnection. Second, that the list covers both existing facilities and those planned within 24 months, since a planned station missing from R1 may not reach R2 or R4 until construction is done. Third, that each identified facility has a named primary control center, because the R4 evaluation extends to that control center and a wrong control center assignment sends the evaluation to the wrong site. Ask whether the 30 or 60 calendar month cycle selected under Part 1.1 is recorded with the reason for the choice, since the cycle depends on whether the prior assessment identified any facility.

How DeployOpen prepares CIP-014 R1 evidence

DeployOpen helps Transmission Owners prepare the systems, records and evidence behind their CIP-014-3 R1 transmission risk assessment, inside their own infrastructure. The Transmission Owner keeps ownership of the analysis and its conclusions, and only an independent reviewer or auditor can issue an assessment or report.

How we scope

Agree in writing which stations, substations and planning horizons the R1 assessment will cover.
Confirm which transmission analyses, study tools and data sources the Transmission Owner already uses.
Define the deliverables, responsibilities and dates before any work starts, since engagements are fixed-scope.

How we build

Set up the document and evidence repository so each assessment version, its inputs and approvals are retained.
Configure role-based access so only authorized staff can view or change the assessment and its underlying data.
Build a tracking record for the 30 and 60 calendar month review cycles and the primary control center mapping.

How we hand over

Deliver the documented assessment package, including the identified facilities and their primary control centers.
Provide version history showing what changed, when and by whom, so an assessor can trace each revision.
Walk the Transmission Owner's staff through the evidence index so they can answer assessor questions without us.

How we support

Offer ongoing support and periodic reassessment preparation as a retainer after the initial handover.
Update the evidence set when the planning horizon changes or new facilities enter the 24 month window.
Coordinate with the independent third-party verification and review that CIP-014-3 requires for the assessment.

CIP-014-3 R1 Transmission risk assessment